In recent years, many consumers have discovered the convenience and economy of purchasing goods and services electronically. A number of channels for electronic purchases (commonly called “e-purchases”) are available, including shop-at-home television networks, call-in responses to television advertisements, and the like. Most recently, direct purchasing via the Internet has become extremely popular.
In a typical Internet transaction, a consumer generally identifies goods and/or services for purchase by viewing an online advertisement such as a hypertext markup language (HTML) document provided via a World Wide Web (WWW) browser. Payment typically occurs via a charge card number that is provided via a secure channel such as a secure sockets layer (SSL) connection that is established between the consumer and the merchant. A charge card account number is typically a sixteen-digit charge card number. Credit or charge card numbers typically comply with a standardized format having four spaced sets of numbers, as represented by the number “0000 0000 0000 0000”. The first five to seven digits are reserved for processing purposes and identify the issuing bank, card type, etc. The last sixteenth digit is used as a sum check for the sixteen-digit number. The intermediary eight-to-ten digits are used to uniquely identify the customer. The merchant then processes the charge card number by, for example, receiving direct authorization from the card issuer, then the merchant completes the transaction. The SSL standard is described by, for example, “The SSL Protocol Version 3.0” dated Nov. 18, 1996, which is available online at http://home.netscape.com/eng/ssl3/draft302.txt, the entire contents of which are incorporated herein by reference.
Although millions of transactions take place every day via the Internet, conventional SSL transactions often exhibit a number of marked disadvantages. Although SSL typically provides a secure end-to-end connection that prevents unscrupulous third parties from eavesdropping (e.g., “sniffing”) or otherwise obtaining a purchaser's charge card number, the protocol does not provide any means for ensuring that the charge card number itself is valid, or that the person providing the card number is legally authorized to do so. Because of the high incidence of fraud in Internet transactions, most charge card issuers consider network transactions to be “Card Not Present” transactions subject to a higher discount rate. Stated another way, because of the increased risk from “Card Not Present” transactions, most charge card issuers charge the merchant a higher rate for accepting card numbers via electronic means than would be charged if the card were physically presented to the merchant.
To improve the security deficiencies inherent in transporting charge card numbers over unsecure networks, many have suggested the use of “smart cards.” Smart cards typically include an integrated circuit chip having a microprocessor and memory for storing data directly on the card. The data can correspond to a cryptographic key, for example, or to an electronic purse that maintains an electronic value of currency. Many smartcard schemes have been suggested in the prior art, but these typically exhibit a marked disadvantage in that they are non-standard. In other words, merchants typically must obtain new, proprietary software for their Web storefronts to accept smartcard transactions. Moreover, the administration costs involved with assigning and maintaining the cryptographic information associated with smart cards have been excessive to date.
The Secure Electronic Transaction (SET) standard has been suggested to improve the security of Internet transactions through the use of various cryptographic techniques. Although SET does provide improved security over standard SSL transactions, the administration involved with the various public and private keys required to conduct transactions has limited SET's widespread acceptance. SET also requires special software for those merchants wishing to support SET transactions.
Existing digital wallet technology, such as the digital wallet technology provided by, for example, GlobeSet, Inc., 1250 Capital of Texas Highway South, Building One, Suite 300, Austin, Tex. 78746, provides a means for customers to utilize transaction card products (e.g., credit, charge, debit, smart cards, account numbers and the like) to pay for products and services on-line. In general, digital wallets are tools which store personal information (name, address, charge card number, credit card number, etc.) in order to facilitate electronic commerce or other network interactions. The personal information can be stored on a general server or at a client location (PC or Smartcard) or on a hybrid of both a general server and a client server. The digital wallet general server is comprised of a Web server and a database server which centrally houses the customer's personal and credit card information, shopping preferences and profiles of on-line merchants.
In an exemplary embodiment, a digital wallet performs functions such as single sign on/one password, automatic form filling of check out pages, one- or two-click purchasing, personalization of Websites, on-line order and delivery tracking, itemized electronic receipts, and customized offers and promotions based upon spending patterns and opt-ins. More particularly, a one-click purchase activates the wallet and confirms the purchase at the same time. A two-click check out first activates the wallet, then the second click confirms the purchase.
In use, the wallet bookmark is typically clicked by the customer and an SSL session is established with the Wallet server. A browser plug-in is executed and the customer supplies an ID/password or smartcard for authentication in order to gain access to the wallet data. When shopping at an on-line merchant, the appropriate wallet data is transferred from the wallet server to the merchant's Web server.
Further still, even with the use of electronic wallets and smartcards, there is a desire to further safeguard electronic transactions against evolving threats. While existing systems may provide for the limited use of personal identifiers such as PINs, these PINs can easily be duplicated and/or discovered.
Thus, a new system of conducting electronic transactions is therefore desired. Such a system should provide improved security that would require the use of a personal identifier, such as a biometric to safeguard the transactions.